hook | f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf

Analysis

max time kernel
152s
max time network
157s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
19-02-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf.apk
Size

1.1MB
MD5

eb61c894491a192894ef5fdbd3050fba
SHA1

c416ebd5c6a51ed1e42756f0e99420fd6541cce9
SHA256

f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf
SHA512

82c211adb2b7b9cbd8946dc14514c8672127eed5e63d78ca29c7cf9c3e7796886ad2223235790e4a1b3f965fbd362a30db89d81975749d5deea6818ad0ed0591
SSDEEP

24576:wdcIPWAeDMNPJdLVOk1ipG2lB7jzY48ojyun3g/lnN5:wpPWuJqAipG47jzSXun3g/n5

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://163.5.169.11:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
2c9270cf5e76e98e9a009b3d1b42c9b8

SHA1
f16ce287e359633f6ba5cff9bf2cb10c73edaa5f

SHA256
7b12d79cfbf69b84297671dda21a2c96db4718f432127f69401dca34e2ef4500

SHA512
f2b129404c2ea32d2339188a92891c829c8f653514419fe37860eaa43c0070e603dc8e2e6c0aae9d23f72c0b838814878fbc909c4f35461d5147171b68b4a957

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
53aba2d2491f1b9cad010bb891004406

SHA1
eb8019af3155d528cef4a847c036394a3b528768

SHA256
726ac2161cd88cb5e84fa49f3990affff856a9af619e4eba8c1cd8ffcd368d21

SHA512
b1d4de4c8bedccac06735ff851d19eee0c83a71d8d9c26c24817519a8471a645635ecab31d161233bc4ec01e3dc10e4f7cd6ad8b5909147a37ac698347018ae2

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
2bf4e385053f4c5041c5a3e8267a21a7

SHA1
b5016b47078bb403970f670e66de4e0041b4d963

SHA256
5c8685732b1efac7271a2b33f2649f8913c20dbcfe397fadc41d65b85e2bcb2e

SHA512
e08a15ff7f9ce350d62486b866146dde1cc0bda83f8d866857518d6dd573cbe174c232e7b02915a80dc90086b44bcfdadcbb8491824b177e99cd34791ad185b8

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
c091d1ecb47adb7c5055142958bb4543

SHA1
65155455e140cfdb157d807c0e14cb40b2b4ccc5

SHA256
3d5039fba60338ae9d2afac7836d2a07e2c4b396499098892628706e9484e628

SHA512
5d7ed31de053eaa9cf3937b27a537045e678580197bc956950a1b6118f53b8dec9ca5a6d53ffe0f69a5721bca6ce27188e2a0f73c397d33fb66d3c078fa6ec6f

Download Submit